@enrichlayer/el-linear 1.7.0 → 1.9.0

package/dist/commands/projects.js

@@ -7,74 +7,129 @@ import { createLinearService } from "../utils/linear-service.js";
 import { logger } from "../utils/logger.js";
 import { handleAsyncCommand, outputSuccess } from "../utils/output.js";
 import { getRootOpts } from "../utils/root-opts.js";
+import { renderCsv, renderFixedWidthTable, renderMarkdownTable, } from "../utils/table-formatter.js";
 import { isUuid } from "../utils/uuid.js";
 import { splitList } from "../utils/validators.js";
-function formatProjectsOutput(projects, format, fieldNames) {
-    const fields = fieldNames ?? [
-        "name",
-        "state",
-        "progress",
-        "teams",
-        "lead",
-        "targetDate",
-    ];
-    const rows = projects.map((p) => {
-        const row = {};
-        for (const f of fields) {
-            switch (f) {
-                case "name":
-                    row[f] = p.name;
-                    break;
-                case "state":
-                    row[f] = p.state ?? "";
-                    break;
-                case "progress":
-                    row[f] =
-                        p.progress !== undefined ? `${Math.round(p.progress * 100)}%` : "";
-                    break;
-                case "teams":
-                    row[f] = p.teams?.map((t) => t.key).join(", ") ?? "";
-                    break;
-                case "lead":
-                    row[f] = p.lead?.name ?? "";
-                    break;
-                case "targetDate":
-                    row[f] = p.targetDate ?? "";
-                    break;
-                case "id":
-                    row[f] = p.id;
-                    break;
-                default:
-                    row[f] = String(p[f] ?? "");
-            }
+const VALID_PROJECT_STATES = new Set([
+    "backlog",
+    "planned",
+    "started",
+    "paused",
+    "completed",
+    "canceled",
+]);
+function parseStateList(value, flagName) {
+    const states = splitList(value).map((s) => s.toLowerCase());
+    for (const s of states) {
+        if (!VALID_PROJECT_STATES.has(s)) {
+            throw new Error(`Invalid state "${s}" for ${flagName}. Valid: ${[...VALID_PROJECT_STATES].join(", ")}.`);
         }
-        return row;
-    });
+    }
+    return states;
+}
+export function resolveProjectStateFilter(options) {
+    const flags = [options.state, options.excludeState, options.active].filter(Boolean).length;
+    if (flags > 1) {
+        throw new Error("--state, --exclude-state, and --active are mutually exclusive.");
+    }
+    if (options.active) {
+        return { excludeStates: ["completed", "canceled"] };
+    }
+    if (options.state) {
+        return { states: parseStateList(options.state, "--state") };
+    }
+    if (options.excludeState) {
+        return {
+            excludeStates: parseStateList(options.excludeState, "--exclude-state"),
+        };
+    }
+    return {};
+}
+// ── Project column definitions ────────────────────────────────
+//
+// Pre-fix this file inlined an 80-line `formatProjectsOutput`
+// function that hand-rolled column width math, table padding, CSV
+// quoting, and markdown pipe syntax — all duplicating
+// `utils/table-formatter.ts`. Now we declare `ColumnDef<LinearProject>`
+// arrays and let the shared renderers do the work. ALL-938 cleanup.
+const PROJECT_COLUMNS = {
+    name: { key: "name", header: "Name", width: 32, extract: (p) => p.name },
+    state: {
+        key: "state",
+        header: "State",
+        width: 10,
+        extract: (p) => p.state ?? "",
+    },
+    progress: {
+        key: "progress",
+        header: "Progress",
+        width: 10,
+        extract: (p) => p.progress !== undefined ? `${Math.round(p.progress * 100)}%` : "",
+    },
+    teams: {
+        key: "teams",
+        header: "Teams",
+        width: 18,
+        extract: (p) => p.teams?.map((t) => t.key).join(", ") ?? "",
+    },
+    lead: {
+        key: "lead",
+        header: "Lead",
+        width: 18,
+        extract: (p) => p.lead?.name ?? "",
+    },
+    targetDate: {
+        key: "targetDate",
+        header: "Target",
+        width: 12,
+        extract: (p) => p.targetDate ?? "",
+    },
+    id: { key: "id", header: "ID", width: 38, extract: (p) => p.id },
+};
+const PROJECT_MD_COLUMNS = {
+    name: { header: "Name", extract: (p) => p.name },
+    state: { header: "State", extract: (p) => p.state ?? "" },
+    progress: {
+        header: "Progress",
+        extract: (p) => p.progress !== undefined ? `${Math.round(p.progress * 100)}%` : "",
+    },
+    teams: {
+        header: "Teams",
+        extract: (p) => p.teams?.map((t) => t.key).join(", ") ?? "",
+    },
+    lead: { header: "Lead", extract: (p) => p.lead?.name ?? "" },
+    targetDate: { header: "Target", extract: (p) => p.targetDate ?? "" },
+    id: { header: "ID", extract: (p) => p.id },
+};
+const DEFAULT_PROJECT_COLUMNS = [
+    "name",
+    "state",
+    "progress",
+    "teams",
+    "lead",
+    "targetDate",
+];
+function formatProjectsOutput(projects, format, fieldNames) {
+    const keys = fieldNames ?? DEFAULT_PROJECT_COLUMNS;
     if (format === "csv") {
-        logger.info(fields.join(","));
-        for (const row of rows) {
-            logger.info(fields.map((f) => `"${(row[f] ?? "").replace(/"/g, '""')}"`).join(","));
-        }
+        const columns = keys
+            .map((k) => PROJECT_COLUMNS[k])
+            .filter((c) => c !== undefined);
+        logger.info(renderCsv(projects, columns));
         return;
     }
-    // table and md formats
-    const widths = fields.map((f) => Math.max(f.length, ...rows.map((r) => (r[f] ?? "").length)));
-    const separator = format === "md"
-        ? `| ${widths.map((w) => "-".repeat(w)).join(" | ")} |`
-        : widths.map((w) => "-".repeat(w + 2)).join("+");
-    const header = format === "md"
-        ? `| ${fields.map((f, i) => f.padEnd(widths[i])).join(" | ")} |`
-        : fields.map((f, i) => ` ${f.padEnd(widths[i])} `).join("|");
-    logger.info(header);
-    logger.info(separator);
-    for (const row of rows) {
-        const line = format === "md"
-            ? `| ${fields.map((f, i) => (row[f] ?? "").padEnd(widths[i])).join(" | ")} |`
-            : fields
-                .map((f, i) => ` ${(row[f] ?? "").padEnd(widths[i])} `)
-                .join("|");
-        logger.info(line);
+    if (format === "md") {
+        const columns = keys
+            .map((k) => PROJECT_MD_COLUMNS[k])
+            .filter((c) => c !== undefined);
+        logger.info(renderMarkdownTable(projects, columns));
+        return;
     }
+    // Default: fixed-width text table.
+    const columns = keys
+        .map((k) => PROJECT_COLUMNS[k])
+        .filter((c) => c !== undefined);
+    logger.info(renderFixedWidthTable(projects, columns));
 }
 async function resolveProjectWithTeams(graphQLService, projectNameOrId) {
     if (isUuid(projectNameOrId)) {
@@ -303,18 +358,34 @@ export function setupProjectsCommands(program) {
         .command("list")
         .description("List projects")
         .option("-l, --limit <number>", "limit results", "100")
-        .option("--format <format>", "output format (json, table, md, csv)", "json")
+        .option("--format <format>", "output format (json, summary, table, md, csv)", "json")
         .option("--fields <fields>", "columns for table/csv (comma-separated: name,state,progress,teams,lead,targetDate)")
+        .option("--name <substring>", "filter by case-insensitive substring on project name")
+        .option("--state <names>", "include only projects in these states (comma-separated: backlog, planned, started, paused, completed, canceled)")
+        .option("--exclude-state <names>", "exclude projects in these states (comma-separated). Mutually exclusive with --state.")
+        .option("--active", "shorthand for --exclude-state completed,canceled (mutually exclusive with --state / --exclude-state)")
         .action(handleAsyncCommand(async (options, command) => {
         const rootOpts = getRootOpts(command);
         const limit = Number.parseInt(options.limit, 10);
+        const nameFilter = options.name;
+        const stateFilter = resolveProjectStateFilter(options);
         const ttl = resolveCacheTTL({
             configTTL: loadConfig().cacheTTLSeconds,
             noCacheFlag: rootOpts.cache === false,
         });
-        const result = await cached(`projects-list-limit:${limit}`, ttl, async () => {
+        // Cache key includes filter inputs so different filter combinations
+        // don't collide.
+        const cacheKey = `projects-list-limit:${limit}` +
+            `-name:${nameFilter ?? "_all"}` +
+            `-states:${stateFilter.states?.join(",") ?? "_any"}` +
+            `-excl:${stateFilter.excludeStates?.join(",") ?? "_none"}`;
+        const result = await cached(cacheKey, ttl, async () => {
             const service = await createLinearService(rootOpts);
-            return service.getProjects(limit);
+            return service.getProjects(limit, {
+                nameFilter,
+                states: stateFilter.states,
+                excludeStates: stateFilter.excludeStates,
+            });
         });
         const format = options.format;
         if (format === "table" ||

package/dist/commands/read-shortcut.d.ts

@@ -4,3 +4,9 @@ import type { Command } from "commander";
  * issue identifiers so `el-linear ADM-652` works without the `issues read` prefix.
  */
 export declare function setupReadShortcut(program: Command): void;
+/**
+ * Shared `issues read` body — exported so the top-level shortcut and
+ * `issues read` (in `commands/issues.ts`) both call one implementation
+ * instead of carrying byte-equivalent duplicates. ALL-938 cleanup.
+ */
+export declare function readIssues(issueIds: string[], _options: Record<string, unknown>, command: Command): Promise<void>;

package/dist/commands/read-shortcut.js

@@ -49,7 +49,12 @@ export function setupReadShortcut(program) {
         return originalParse(argv, parseOptions);
     };
 }
-async function readIssues(issueIds, _options, command) {
+/**
+ * Shared `issues read` body — exported so the top-level shortcut and
+ * `issues read` (in `commands/issues.ts`) both call one implementation
+ * instead of carrying byte-equivalent duplicates. ALL-938 cleanup.
+ */
+export async function readIssues(issueIds, _options, command) {
     const rootOpts = getRootOpts(command);
     const graphQLService = await createGraphQLService(rootOpts);
     const linearService = await createLinearService(rootOpts);

package/dist/commands/refs.js

@@ -3,6 +3,7 @@ import { createGraphQLService } from "../utils/graphql-service.js";
 import { extractIssueReferences } from "../utils/issue-reference-extractor.js";
 import { wrapIssueReferencesAsLinks, } from "../utils/issue-reference-wrapper.js";
 import { createLinearService } from "../utils/linear-service.js";
+import { logger } from "../utils/logger.js";
 import { handleAsyncCommand } from "../utils/output.js";
 import { getRootOpts } from "../utils/root-opts.js";
 import { validateReferences } from "../utils/validate-references.js";
@@ -73,7 +74,7 @@ async function handleWrap(options, command) {
     };
     if (!validate) {
         // stderr advisory only — keeps stdout a clean text stream for piping.
-        process.stderr.write("el-linear refs wrap: --no-validate set; emitting links for every regex match without checking the workspace.\n");
+        logger.error("el-linear refs wrap: --no-validate set; emitting links for every regex match without checking the workspace.");
     }
     const wrapped = await wrapRefsCore({ text, target, validate }, deps);
     process.stdout.write(wrapped);

package/dist/commands/templates.js

@@ -1,4 +1,5 @@
-import { TEMPLATE_BY_ID_QUERY, TEMPLATES_LIST_QUERY, } from "../queries/templates.js";
+import { readFileSync } from "node:fs";
+import { TEMPLATE_BY_ID_QUERY, TEMPLATE_CREATE_MUTATION, TEMPLATE_DELETE_MUTATION, TEMPLATE_UPDATE_MUTATION, TEMPLATES_LIST_QUERY, } from "../queries/templates.js";
 import { createGraphQLService } from "../utils/graphql-service.js";
 import { handleAsyncCommand, outputSuccess } from "../utils/output.js";
 import { getRootOpts } from "../utils/root-opts.js";
@@ -56,4 +57,129 @@ export function setupTemplatesCommands(program) {
         }
         outputSuccess(template);
     }));
+    templates
+        .command("create")
+        .description("Create a new issue / document / project template")
+        .requiredOption("--type <type>", "template kind (issue, document, project, recurringIssue)")
+        .requiredOption("--name <name>", "template display name")
+        .requiredOption("--team-id <id>", "team id (UUID) the template belongs to. See `el-linear teams list`")
+        .option("--description <text>", "description shown in the template picker")
+        .option("--data <json>", "templateData as a JSON string (typically { title, description, labelIds, priority })")
+        .option("--data-file <path>", "templateData read from a JSON file (relative path). Mutually exclusive with --data")
+        .option("--allow-absolute", "allow --data-file to read absolute or `..`-traversing paths (file contents are sent to Linear's API)")
+        .option("--icon <name>", "Lucide icon name shown in the picker")
+        .option("--color <hex>", "color (hex) for the template badge")
+        .action(handleAsyncCommand(async (options, command) => {
+        const rootOpts = getRootOpts(command);
+        const graphQLService = await createGraphQLService(rootOpts);
+        const templateData = parseTemplateData(options);
+        const input = {
+            type: options.type,
+            name: options.name,
+            teamId: options.teamId,
+        };
+        if (options.description)
+            input.description = options.description;
+        if (templateData !== undefined)
+            input.templateData = templateData;
+        if (options.icon)
+            input.icon = options.icon;
+        if (options.color)
+            input.color = options.color;
+        const result = await graphQLService.rawRequest(TEMPLATE_CREATE_MUTATION, { input });
+        const payload = result.templateCreate;
+        if (!payload?.success) {
+            throw new Error("templateCreate returned success=false");
+        }
+        outputSuccess(payload.template);
+    }));
+    templates
+        .command("update <templateId>")
+        .description("Update a template's name, description, templateData, icon, or color")
+        .option("--name <name>", "new display name")
+        .option("--description <text>", "new description")
+        .option("--data <json>", "new templateData as a JSON string")
+        .option("--data-file <path>", "new templateData read from a JSON file (relative path)")
+        .option("--allow-absolute", "allow --data-file to read absolute or `..`-traversing paths")
+        .option("--icon <name>", "Lucide icon name")
+        .option("--color <hex>", "color (hex)")
+        .option("--team-id <id>", "move the template to a different team")
+        .action(handleAsyncCommand(async (templateId, options, command) => {
+        const rootOpts = getRootOpts(command);
+        const graphQLService = await createGraphQLService(rootOpts);
+        const input = {};
+        if (options.name)
+            input.name = options.name;
+        if (options.description !== undefined) {
+            input.description = options.description;
+        }
+        const templateData = parseTemplateData(options);
+        if (templateData !== undefined)
+            input.templateData = templateData;
+        if (options.icon)
+            input.icon = options.icon;
+        if (options.color)
+            input.color = options.color;
+        if (options.teamId)
+            input.teamId = options.teamId;
+        if (Object.keys(input).length === 0) {
+            throw new Error("templates update: at least one of --name, --description, --data, --data-file, --icon, --color, --team-id is required");
+        }
+        const result = await graphQLService.rawRequest(TEMPLATE_UPDATE_MUTATION, { id: templateId, input });
+        const payload = result.templateUpdate;
+        if (!payload?.success) {
+            throw new Error("templateUpdate returned success=false");
+        }
+        outputSuccess(payload.template);
+    }));
+    templates
+        .command("delete <templateId>")
+        .description("Delete a template (cannot be undone)")
+        .action(handleAsyncCommand(async (templateId, _options, command) => {
+        const rootOpts = getRootOpts(command);
+        const graphQLService = await createGraphQLService(rootOpts);
+        const result = await graphQLService.rawRequest(TEMPLATE_DELETE_MUTATION, { id: templateId });
+        const payload = result.templateDelete;
+        if (!payload?.success) {
+            throw new Error("templateDelete returned success=false");
+        }
+        outputSuccess({ id: templateId, deleted: true });
+    }));
+}
+/**
+ * Resolve `--data <json>` or `--data-file <path>` into the parsed
+ * templateData object. Returns undefined when neither flag was set
+ * so the caller can omit the field from the input object.
+ */
+function parseTemplateData(options) {
+    if (options.data && options.dataFile) {
+        throw new Error("Pass either --data or --data-file, not both");
+    }
+    if (options.data) {
+        try {
+            return JSON.parse(options.data);
+        }
+        catch (err) {
+            throw new Error(`--data is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (options.dataFile) {
+        const dataFile = String(options.dataFile);
+        // Reject absolute paths and `..` traversal unless explicitly
+        // allowed. CI invocations or scripted callers can pass an
+        // attacker-controlled path otherwise (e.g. `~/.aws/credentials.json`,
+        // `/etc/passwd`) and have its contents flow into Linear's API
+        // via the `templateData` field.
+        if (!options.allowAbsolute && /^(\/|\.\.\/|\.\.\\)/.test(dataFile)) {
+            throw new Error(`--data-file ${dataFile} resolves outside the current directory. Pass --allow-absolute to opt in (sends file contents to Linear's API).`);
+        }
+        const raw = readFileSync(dataFile, "utf8");
+        try {
+            return JSON.parse(raw);
+        }
+        catch (err) {
+            throw new Error(`--data-file ${dataFile} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return undefined;
 }

package/dist/commands/users.js

@@ -8,11 +8,12 @@ export function setupUsersCommands(program) {
         .command("list")
         .description("List all users")
         .option("--active", "Only show active users")
+        .option("--name <substring>", "filter by case-insensitive substring on user name")
         .option("-l, --limit <number>", "limit results", "100")
         .action(handleAsyncCommand(async (options, command) => {
         const rootOpts = getRootOpts(command);
         const service = await createLinearService(rootOpts);
-        const result = await service.getUsers(options.active, Number.parseInt(options.limit, 10));
+        const result = await service.getUsers(options.active, Number.parseInt(options.limit, 10), options.name);
         outputSuccess({ data: result, meta: { count: result.length } });
     }));
 }

package/dist/config/config.js

@@ -22,23 +22,38 @@ const DEFAULT_CONFIG = {
     },
     terms: [],
 };
-let cachedConfig;
+// Profile-keyed cache. Pre-fix this was a single `cachedConfig` —
+// switching the active profile mid-process and calling `loadConfig`
+// again would return the OLD profile's config until
+// `_resetConfigCacheForTests` ran. Today the CLI sets the profile
+// in `preAction` before any command body, so this is latent — but
+// keying by profile makes it future-proof and makes test isolation
+// less footgun-prone (profile A's setup pollutes profile B's read).
+// ALL-935 deferred fix.
+//
+// Key: `null` for the legacy single-file layout (no active profile),
+// otherwise the profile name. We never mix the two paths in the
+// cache — the marker name selects exactly one path.
+const cachedConfigByProfile = new Map();
 /** Test seam — resets the cache between test cases. */
 export function _resetConfigCacheForTests() {
-    cachedConfig = undefined;
+    cachedConfigByProfile.clear();
 }
 export function loadConfig() {
-    if (cachedConfig) {
-        return cachedConfig;
-    }
     // Profile-aware: read from <CONFIG_DIR>/profiles/<name>/config.json
     // when a profile is active, falling back to the legacy single-file
     // path so existing setups keep working without migration.
     const active = resolveActiveProfile();
+    const cacheKey = active.name;
+    const cached = cachedConfigByProfile.get(cacheKey);
+    if (cached) {
+        return cached;
+    }
     const candidates = [active.configPath];
     if (active.configPath !== CONFIG_PATH)
         candidates.push(CONFIG_PATH);
     const sourcePath = candidates.find((p) => fs.existsSync(p));
+    let resolved;
     if (sourcePath) {
         try {
             const userConfig = JSON.parse(fs.readFileSync(sourcePath, "utf8"));
@@ -61,11 +76,11 @@ export function loadConfig() {
                 }
                 delete userConfig.brand;
             }
-            cachedConfig = deepMerge(DEFAULT_CONFIG, userConfig);
+            resolved = deepMerge(DEFAULT_CONFIG, userConfig);
         }
         catch {
             outputWarning(`Failed to parse ${sourcePath}, using empty defaults`);
-            cachedConfig = DEFAULT_CONFIG;
+            resolved = DEFAULT_CONFIG;
         }
     }
     else {
@@ -73,13 +88,20 @@ export function loadConfig() {
             ? ` (active profile: \`${active.name}\` — expected at ${active.configPath})`
             : "";
         outputWarning(`No config found at ${active.configPath}${profileNote}. Run \`el-linear init\` (or \`el-linear profile add ${active.name ?? "<name>"}\`) to create one.`);
-        cachedConfig = DEFAULT_CONFIG;
+        resolved = DEFAULT_CONFIG;
     }
-    return cachedConfig;
+    cachedConfigByProfile.set(cacheKey, resolved);
+    return resolved;
 }
 function deepMerge(target, source) {
     const result = { ...target };
     for (const key of Object.keys(source)) {
+        // Reject prototype-pollution keys regardless of value shape: a
+        // hand-edited config.json with `__proto__` would otherwise mutate
+        // Object.prototype for the whole process.
+        if (key === "__proto__" || key === "constructor" || key === "prototype") {
+            continue;
+        }
         if (source[key] &&
             typeof source[key] === "object" &&
             !Array.isArray(source[key]) &&

package/dist/config/issue-validation.js

@@ -252,7 +252,7 @@ function checkTitleVerbAlignment(title, typeLabel, result) {
  */
 export function enforceValidation(result) {
     for (const warning of result.warnings) {
-        outputWarning(warning, "validation");
+        outputWarning(warning);
     }
     if (result.errors.length > 0) {
         const errorMsg = "Issue creation blocked by validation:\n\n" +

package/dist/config/paths.d.ts

@@ -31,9 +31,20 @@ export interface ProfileFsOps {
     readFileSync: (p: string) => string;
     existsSync: (p: string) => boolean;
 }
+/**
+ * Conservative profile-name charset. Rejects path traversal (`..`, `/`),
+ * shell metacharacters, and Unicode lookalikes that would confuse `profile
+ * use` or let `--profile`/EL_LINEAR_PROFILE/active-profile escape out of
+ * <CONFIG_DIR>/profiles/.
+ */
+export declare function isSafeProfileName(name: string): boolean;
 /**
  * Set the active profile for the duration of this process. Pass `null`
  * to clear the override and fall back to env / on-disk markers.
+ *
+ * @throws when `name` is not a safe profile name. Validation lives here
+ * so every entry point (CLI flag, env var, marker file) goes through one
+ * gate — see `resolveActiveProfile`.
  */
 export declare function setActiveProfileForSession(name: string | null): void;
 /** Read-only accessor for the per-session override (test seam). */

package/dist/config/paths.js

@@ -44,6 +44,15 @@ const DEFAULT_FS_OPS = {
     readFileSync: (p) => fs.readFileSync(p, "utf8"),
     existsSync: (p) => fs.existsSync(p),
 };
+/**
+ * Conservative profile-name charset. Rejects path traversal (`..`, `/`),
+ * shell metacharacters, and Unicode lookalikes that would confuse `profile
+ * use` or let `--profile`/EL_LINEAR_PROFILE/active-profile escape out of
+ * <CONFIG_DIR>/profiles/.
+ */
+export function isSafeProfileName(name) {
+    return /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/.test(name);
+}
 /**
  * Per-process override for the active profile name. Set by main.ts when
  * `--profile <name>` is passed (highest priority).
@@ -52,9 +61,25 @@ let sessionProfileOverride = null;
 /**
  * Set the active profile for the duration of this process. Pass `null`
  * to clear the override and fall back to env / on-disk markers.
+ *
+ * @throws when `name` is not a safe profile name. Validation lives here
+ * so every entry point (CLI flag, env var, marker file) goes through one
+ * gate — see `resolveActiveProfile`.
  */
 export function setActiveProfileForSession(name) {
-    sessionProfileOverride = name && name.trim().length > 0 ? name.trim() : null;
+    if (name === null) {
+        sessionProfileOverride = null;
+        return;
+    }
+    const trimmed = name.trim();
+    if (trimmed.length === 0) {
+        sessionProfileOverride = null;
+        return;
+    }
+    if (!isSafeProfileName(trimmed)) {
+        throw new Error(`Invalid profile name "${trimmed}". Allowed: [A-Za-z0-9][A-Za-z0-9_.-]{0,63}.`);
+    }
+    sessionProfileOverride = trimmed;
 }
 /** Read-only accessor for the per-session override (test seam). */
 export function getSessionProfileOverride() {
@@ -66,11 +91,24 @@ export function getSessionProfileOverride() {
  * keep working without migration.
  */
 export function resolveActiveProfile(env = process.env, fsImpl = DEFAULT_FS_OPS) {
-    const explicit = sessionProfileOverride ??
-        (env.EL_LINEAR_PROFILE?.trim() || null) ??
-        readActiveProfileMarker(fsImpl);
-    if (explicit) {
-        return profilePaths(explicit);
+    // session override is already validated at write time (see
+    // setActiveProfileForSession). Env var is explicit user input and
+    // must fail loudly. Marker file is our own on-disk state; treat
+    // invalid contents as "no marker" so a stale/corrupt file doesn't
+    // brick every command.
+    if (sessionProfileOverride) {
+        return profilePaths(sessionProfileOverride);
+    }
+    const envName = env.EL_LINEAR_PROFILE?.trim();
+    if (envName) {
+        if (!isSafeProfileName(envName)) {
+            throw new Error(`Invalid EL_LINEAR_PROFILE value "${envName}". Allowed: [A-Za-z0-9][A-Za-z0-9_.-]{0,63}.`);
+        }
+        return profilePaths(envName);
+    }
+    const marker = readActiveProfileMarker(fsImpl);
+    if (marker && isSafeProfileName(marker)) {
+        return profilePaths(marker);
     }
     return {
         name: null,

package/dist/config/term-enforcer.js

@@ -62,7 +62,7 @@ export function enforceTerms(texts, options = {}) {
     if (options.strict) {
         throw new Error(`Term enforcement failed:\n${warnings.map((w) => `  - ${w}`).join("\n")}`);
     }
-    outputWarning(warnings, "term_enforcement");
+    outputWarning(warnings);
 }
 function escapeRegExp(string) {
     return string.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");